Fix jwt-token

server/middleware/multi-tenant-auth.js

@@ -30,6 +30,15 @@ class MultiTenantAuth {
     this.models = models;
   }
 
+  /**
+   * Check if a string is an IP address
+   */
+  isIPAddress(str) {
+    const ipv4Regex = /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/;
+    const ipv6Regex = /^([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$/;
+    return ipv4Regex.test(str) || ipv6Regex.test(str);
+  }
+
   /**
    * Initialize all authentication providers
    */
@@ -89,13 +98,17 @@ class MultiTenantAuth {
 
     // Method 5: Subdomain (tenant.yourapp.com)
     const hostname = req.hostname || req.headers.host || '';
-    if (hostname && !hostname.startsWith('localhost')) {
-      const hostParts = hostname.split('.');
+    // Remove port number if present
+    const hostWithoutPort = hostname.split(':')[0];
+    
+    // Skip if localhost or IP address
+    if (hostname && !hostname.startsWith('localhost') && !this.isIPAddress(hostWithoutPort)) {
+      const hostParts = hostWithoutPort.split('.');
       // Only treat as subdomain if there are at least 2 parts (subdomain.domain.com)
       // and the first part is not a common root domain
       if (hostParts.length >= 3) {
         const subdomain = hostParts[0];
-        if (subdomain && subdomain !== 'www' && subdomain !== 'api' && !subdomain.includes(':')) {
+        if (subdomain && subdomain !== 'www' && subdomain !== 'api') {
           console.log('🏢 Tenant from subdomain:', subdomain);
           return subdomain;
         }